VulnerabilityAnalyzed

CVE-2026-44873

A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled.

MEDIUM 5.4EPSS 0.14%

Does this matter?

Lower severity and a low EPSS score (0.14%). Track it; it rarely justifies an emergency change on its own.

Description

A session management vulnerability in AOS-8 allows previously authenticated users to retain network access after their accounts are administratively disabled. Existing sessions are not invalidated when credentials are revoked, enabling continued access until session expiration. An attacker with compromised credentials could exploit this behavior to maintain unauthorized access even after the account has been disabled.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.14% probability · 4th percentile
CISA KEV: Not listed
Weakness: CWE-613
Affected: arubanetworks/arubaos · arubanetworks/sd-wan
Source: security-alert@hpe.com

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_USVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.